Configure Smart Card Redirection on a RHEL or Rocky Linux 9.x/8.x Virtual Machine

To configure smart card redirection on a RHEL or Rocky Linux 9.x/8.x virtual machine (VM), install the libraries on which the feature depends and the root Certificate Authority (CA) certificate to support the trusted authentication of smart cards.

Prerequisites

• Integrate a RHEL or Rocky Linux 9.x/8.x Virtual Machine with Active Directory for Smart Card Redirection
• To use the smart card single sign-on (SSO) feature in FIPS mode, ensure that you have completed all the steps described in Configure a FIPS-compliant Linux Virtual Machine. You must add the trusted CA certificate for BlastServer to rui.crt and add the key paired with rui.crt to rui.key`.

Procedure

1. Install the required libraries.

   sudo yum install -y opensc pcsc-lite pcsc-lite-libs pcsc-lite-ccid nss-tools
   

2. Enable the pcscd service.

   sudo systemctl enable pcscd
   sudo systemctl start pcscd
   

3. Make sure that the /etc/sssd/sssd.conf configuration file contains the following lines, which enable smart card authentication.

   [pam]
   pam_cert_auth = True
   

4. Copy the required CA certificate to /etc/sssd/pki/sssd_auth_ca_db.pem.

   sudo openssl x509 -inform der -in certificate.cer -out certificate.pem
   sudo cp certificate.pem /etc/sssd/pki/sssd_auth_ca_db.pem
   

5. To verify the status of the smart card, run the following pkcs11-tool commands and confirm that they return the correct output.

   sudo pkcs11-tool -L
   
   sudo pkcs11-tool --login -O
   
   sudo pkcs11-tool --test --login
   

6. To support the smart card SSO feature, configure the viewagent-greeter.conf file. See Setting Options in Configuration Files on a Linux Desktop.

7. Install the Horizon Agent package, with smart card redirection enabled.

   • If using the .rpm installer:

     1. Run the installer to install Horizon Agent with the default feature options.

     2. To add the smart card redirection feature, run the ViewSetup.sh script.

   • If using the .tar.gz installer, run the installer with the parameter to enable smart card redirection:

   ```
   

   sudo ./install_viewagent.sh -m yes
   ```
   

   Note: If you get an error message instructing you to install the default PC/SC Lite library, uninstall the custom PC/SC Lite library that is currently present on the machine and install the default PC/SC Lite library using the following command.

   sudo yum reinstall pcsc-lite-libs pcsc-lite
   

   You can then run the Horizon Agent installer.

8. If you are using a custom PC/SC Lite library, configure the pcscd.maxReaderContext and pcscd.readBody options in the config file.

   See Setting Options in Configuration Files on a Linux Desktop.

9. Restart the virtual machine and log back in.